Zabbix: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. (CVE-2026-23929)

Zabbix contains a prototype pollution vulnerability in the searchParamsToObject() function that results in persistent XSS in the Maps component. The flaw is due to insufficient filtering of URL parameters, allowing dangerous properties such as __proto__ to be processed. This, combined with jQuery's unsafe element creation that traverses the prototype chain, enables attackers to inject malicious scripts that persist in the application context. The vulnerability is identified as CVE-2026-23929 and affects multiple specific Ubuntu package versions of Zabbix.

Successful exploitation of this vulnerability allows an attacker with limited privileges to inject persistent malicious scripts into the Maps feature of Zabbix. This can lead to partial compromise of confidentiality and integrity within the affected application context. The CVSS score of 5.4 (medium severity) reflects the need for user interaction and limited privileges required for exploitation, but the impact includes potential persistent XSS attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, users should consider restricting access to the affected Maps feature and carefully validate or sanitize URL parameters to prevent prototype pollution. Monitor vendor advisories for updates on official fixes.